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DECLARATION OF JASON T. SWEENEY 
PURSUANT TO 28 U.S.C. § 1746 


. I, Jason T. Sweeney, state that I have personal knowledge of the facts and matters set 


forth below, and if called as a witness would testify competently thereto: 


. TamaU.S. citizen over the age of eighteen years old. 


. Lama Digital Forensic Analyst with CACI, Inc., 6315 Bren Mar Drive, Suite 175, 


Alexandria, VA 22312. I am EnCE Certified and have been practicing forensics for over 
four years. As part of my job duties, I often do contract computer forensic work for the 
Federal Trade Commission (FTC). 


. On September 19, 2014, in connection with a pending lawsuit, FTC v. Buterfly Labs, 


Hugh Huettner, Technical Forensic Examiner, FTC, 600 Pennsylvania Avenue, NW, 
Washington, DC 20580, instructed me to forensically image the digital media located at 
10770 El Monte Street, Suite 101, Leawood, KS 66211. 


. Larrived at 10770 El Monte Street, Suite 101, Leawood, KS 66211 and Leah Frazier 


allowed me access to the digital media. 


. I proceeded to make forensically sound images of: 


BFL-ELM-ITO1-SonnyVleisides - One Lenovo ThinkPad T430s laptop computer 
identified as Serial # RORABEY containing one Intel SSDSC2BC1180A3L 180GB solid 
state drive identified as Serial # CVCV224006XM180EGN. This computer was 
identified as belonging to Sonny Vleisides. 


BFL-ELM-IT03-DaveMcClain - One generic computer containing one Samsung MZ- 
7PD128 128GB solid state drive identified as Serial # S12PNEACC06850A. This 
computer was identified as belonging to Dave McClain. 


BFL-ELM-IT09b-JohnMutrux - One Lenovo ThinkPad T520 laptop computer identified 
as Serial # ROPVX4P containing one Chronos MKNSSDCR240GB-DX 240GB solid 
state drive identified as Serial # MK130801AS1068913. This computer was identified as 
belonging to John Mutrux. 


BFL-ELM-IT10a-DeskM9 — Partition sda of one Lenovo ThinkPad T430 laptop 
computer identified as Serial # PBTOPG5 containing one SanDisk solid state drive 
identified as Serial # 130662402658. This computer was identified as being found at 
Desk M9. 
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BFL-ELM-IT10b-DeskM9 — Partition sdb of one Lenovo ThinkPad T430 laptop 
computer identified as Serial # PBTOPGS containing one SanDisk solid state drive 
identified as Serial # 130662402658. This computer was identified as being found at 
Desk M9. 


BFL-ELM-IT13-JohnMutrux - One 8GB USB thumb drive found in the desk identifie 
as belonging to John Mutrux. 


BFL-ELM-IT018-DaveMcClain - One 1GB USB thumb drive found in the des 
identified as belonging to Dave McClain. 


. I proceeded to make forensically sound logical images of selected files from: 


BFL-ELM-IT14-NoahWeaver_SelectedFiles — Selected files from one Lenovo ThinkPad 
T430 laptop computer identified as Serial # PBTOPG3 containing one HGST 
HTS725050A7E630 SOOGB hard drive identified as Serial # YO9IRXZYL. This computer 
was identified as belonging to Noah Weaver. 


BFL-ELM-IT16-MoriahThi — Selected files from one Lenovo ThinkPad T420 laptop 
computer identified as Serial # PBEPFB8 containing one Hitachi HTS727550A9E364 
500GB hard drive identified as Serial # 81GHSXLB. This computer was identified as 
belonging to Moriah Thi. 


. I proceeded to capture active memory and pagefile.sys files from: 


BFL-ELM-IT09a-JohnMutrux - One Lenovo ThinkPad T520 laptop computer identified 
as Serial # ROP VX4P containing one Chronos MKNSSDCR240GB-DX 240GB solid 
state drive identified as Serial # MK130801AS1068913. This computer was identified as 
belonging to John Mutrux. 


. I proceeded to perform forensic previews of: 


One Lenovo ThinkPad T430 laptop computer identified as belonging to Debbie 
Hernandez. No serial numbers recorded. 


One Lenovo ThinkPad T430 laptop computer identified as Serial # PB4CEYT containing 
one HGST HTS725050A7E630 500GB hard drive identified as Serial # WHH6WS5SM. 
This computer was identified as belonging to Paul Anderson. 


One Lenovo ThinkPad T4300 laptop computer identified as Serial # PB3KC8Z 
containing one SanDisk SDSSDHP-256G 256GB solid state drive identified as Serial # 
130662402448. This computer was identified as belonging to Rachel Thi. 
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10. I maintained the hard drive(s) in a secure location until September 20, 2014 when I 
handed signed it/them over to Hugh Huettner, Technical Forensic Examiner, 600 
Pennsylvania Avenue, NW, Washington, DC 20580. I signed the FTC Chain of Custody 
form when I handed the hard drive(s) to Hugh Huettner. 


I declare under penalty of perjury that the foregoing is true and correct. 
Executed on this 23rd day of September, 2014, in Washington, DC. 
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